> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/listeners/netcat.md).
# netcat
**netcat** (often abbreviated to **nc**) is a computer networking utility for reading from and writing to network connections using [TCP](https://en.wikipedia.org/wiki/Transmission_Control_Protocol) or [UDP](https://en.wikipedia.org/wiki/User_Datagram_Protocol). The [command](https://en.wikipedia.org/wiki/Command_\(computing\)) is designed to be a dependable [back-end](https://en.wikipedia.org/wiki/Front_and_back_ends) that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and investigation tool, since it can produce almost any kind of connection its user could need and has a number of built-in capabilities.
## Start a listener
To start a TCP-listener on port 12345
```bash
nc -lvpn 12345
```
## Usage information
nc -h
```bash
┌──(kali㉿kali)-[~/Desktop]
└─$ nc -h
[v1.10-47]
connect to somewhere: nc [-options] hostname port[s] [ports] ...
listen for inbound: nc -l -p port [-options] [hostname] [port]
options:
-c shell commands as `-e'; use /bin/sh to exec [dangerous!!]
-e filename program to exec after connect [dangerous!!]
-b allow broadcasts
-g gateway source-routing hop point[s], up to 8
-G num source-routing pointer: 4, 8, 12, ...
-h this cruft
-i secs delay interval for lines sent, ports scanned
-k set keepalive option on socket
-l listen mode, for inbound connects
-n numeric-only IP addresses, no DNS
-o file hex dump of traffic
-p port local port number
-r randomize local and remote ports
-q secs quit after EOF on stdin and delay of secs
-s addr local source address
-T tos set Type Of Service
-t answer TELNET negotiation
-u UDP mode
-v verbose [use twice to be more verbose]
-w secs timeout for connects and final net reads
-C Send CRLF as line-ending
-z zero-I/O mode [used for scanning]
port numbers can be individual or ranges: lo-hi [inclusive];
hyphens in port names must be backslash escaped (e.g. 'ftp\-data').
```
ncat -h
```bash
┌──(kali㉿kali)-[~/Desktop]
└─$ ncat -h
Ncat 7.94SVN ( https://nmap.org/ncat )
Usage: ncat [options] [hostname] [port]
Options taking a time assume seconds. Append 'ms' for milliseconds,
's' for seconds, 'm' for minutes, or 'h' for hours (e.g. 500ms).
-4 Use IPv4 only
-6 Use IPv6 only
-U, --unixsock Use Unix domain sockets only
--vsock Use vsock sockets only
-C, --crlf Use CRLF for EOL sequence
-c, --sh-exec Executes the given command via /bin/sh
-e, --exec Executes the given command
--lua-exec Executes the given Lua script
-g hop1[,hop2,...] Loose source routing hop points (8 max)
-G Loose source routing hop pointer (4, 8, 12, ...)
-m, --max-conns Maximum simultaneous connections
-h, --help Display this help screen
-d, --delay
## Resources
**nc** - Linux manual page:
**ncat** - Linux manual page:
**ncat** - Users' Guide:
**netcat** - Wikipedia: